What is claimed is: 

1 . A method of holding an election comprising 

enabling voters to register with a registrar facility including providing 
encryption keys to registered voters and storing the encryption key with an 
authenticator facility, 

distributing ballots having unique ballot ID's to requesting voters, 

receiving ballots having voter choices on them and encrypted using voters 
encryption keys, 

receiving from voters 

a) ballot ID, encrypted vote information and, voter ID at an 
authenticator facility, 

b) indications that votes have been cast with a ballots 
having indicated ballot ID's at a distributor facility, and 

a) an indication that the voter has voted at a registrar 

facility, 

authenticating the voter at the authenticator facility and passing 
authenticated votes and the ballot ID to a counter facility. 

2. A method as claimed in claim 1 further comprising 

decrypting votes at the counter facility and tallying a number of votes, 
publishing a list containing encrypted votes and ballot ID's at the authenticator 

facility, 

publishing a list containing encrypted votes and ballot ID's at the counter facility, 
publishing a list containing voter ID's of cast ballots at the authenticator facility, 
examining the list containing voter ID's of cast ballots at the registrar facility to 
confirm that only registered voters voted, 
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verifying at a verifier facility that the list containing encrypted votes and ballot 
ID's published at the authenticator facility is identical to the list containing encrypted 
votes and ballot ID's published at the counter facility, 

confirming at the verifier facility from the list containing encrypted votes and 
ballot ID's published at the authenticator facility and a decryption table the results 
published by the counter facility, 

examining at the distributor facility the list containing encrypted votes and ballot 
ID's published at the authenticator facility and the list containing encrypted votes and 
ballot ID's published at the counter facility to ensure that only legitimate ballots appear, 
and 

releasing the election results at the counter facility. 

3. A method as claimed in claim 1 wherein at least one of the distributing and 
receiving steps includes transmitting information over the Internet. 

4. A method as claimed in claim 1 wherein distributing ballots includes distributing 
a number of ballots from an inventory of ballots that has more members than there are 
registered voters. 

5. A method as claimed in claim 1 wherein distributing ballots includes distributing 
a ballot having a ballot number, and a matching pair made up of plain-text versions of 
ballot choices and encrypted versions of ballot choices. 

6. A method as claimed in claim 5 wherein the encrypted version-is encrypted using 
an encryption key unique to the ballot. 

7. A method as claimed in claim 5 wherein the ballot choices include ballot choices 
in municipal and national elections. 
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8. A method as claimed in claim 2 wherein the acts of publishing include publishing 
to the general public. 



9. 



A method as claimed in claim 1 wherein passing authenticated votes includes 



passing data through a firewall. 

1 0. An election apparatus comprising 

a network of data handling devices configured to hold an election comprising 

a data handling device enabling voters to register with a registrar facility 
including providing encryption keys to registered voters and storing the 
encryption key with an authenticates facility, 

a data handling device distributing ballots having unique ballot ID's to 
requesting voters, 

a data handling device receiving ballots having voter choices on them and 
encrypted using voters encryption keys, 

data handling devices configured as authenticator, distributor and registrar 
facilities enabled to receive from voters 



facility, 

to authenticate the voter at the authenticator facility and passing 
authenticated votes and the ballot ID to a data handling device configured as a 
counter facility. 

10. An election apparatus as claimed in claim 10 wherein at least two of the data 
handling devices communicate information to one another over the Internet. 



a) ballot ID, encrypted vote information and, voter ID at the 
authenticator facility, 

b) indications that votes have been cast with a ballots having 
indicated ballot ID's at the distributor facility, and 

c) an indication that the voter has voted at the registrar 
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11. An election apparatus as claimed in claim 10 wherein the data handling device 
that distributes ballots distributes a number of ballots from an inventory of ballots that 
has more members than there are registered voters. 

12. An election apparatus as claimed in claim 10 wherein the data handling device 
that distributes ballots distributes a ballot having a ballot number, and a matching pair 
made up of plain-text versions of ballot choices and encrypted versions of ballot choices. 

13. An election apparatus as claimed in claim 12 wherein the encrypted version is 
encrypted using an encryption key unique to the ballot. 

14. An election apparatus as claimed in claim 12 wherein the ballot choices include 
ballot choices in municipal and national elections. 

15. An election apparatus as claimed in claim 10 the authenticator is protected by a 
firewall. 
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